CISSP cheat sheet · Domain 2 · 10% of exam
Asset Security
Know what you have, who owns it, how sensitive it is, and how to protect it through its whole lifecycle — including how to destroy it safely.
Rule cards
| Classification | PRIMARY purpose = decide the level of protection (sensitivity is what you measure, not why you classify). Classify at creation. The owner classifies and reviews periodically. |
|---|---|
| Roles | Owner = accountable, classifies, approves access · Custodian = implements (backups, permissions) · Steward = data quality and metadata · Controller = decides purpose and means (GDPR) · Processor = acts on the controller’s behalf · Subject = the person the data is about. |
| Government levels | Top Secret → Secret → Confidential → (Sensitive but) Unclassified. |
| Commercial levels | Confidential / Proprietary → Private → Sensitive → Public. |
| Lifecycle | Create → Store → Use (most exposed — decrypted in memory) → Share → Archive → Destroy. |
| Data states | At rest → AES / full-disk / database encryption · In transit → TLS / IPsec / SSH · In use → memory protection, secure enclaves / confidential computing, homomorphic encryption. |
| Destruction | Match the requirement, not the strongest option: reuse inside → clear · resale / lower security → purge (crypto-erase, degauss magnetic) · leaving control / top secret → destroy · SSD: never degauss · cloud → crypto-shredding · vendor disposal → encrypt first + certificate of destruction. |
| NIST 800-88 | Clear (logical overwrite) · Purge (defeats lab recovery) · Destroy (physical: shred, disintegrate, pulverise, incinerate). |
| Retention | Keep only as long as law and policy require. A legal hold overrides the retention schedule; deleting held data = spoliation. |
| Baselines | Scoping = remove controls that do not apply · Tailoring = modify controls to fit · Supplementing = add more controls. |
| Asset inventory | First step of asset security — you cannot protect what you do not know you have. Include hardware, software, data and owners. |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Data remanence | Data that remains after deletion | A deleted file is still recoverable | Why sanitisation is needed |
| Clear / Purge / Destroy | Overwrite / stronger removal (degauss, crypto-erase) / physically ruin | Reuse in-house / resell / shred | Choose by reuse + sensitivity |
| Degaussing | Strong magnetic field erases magnetic media | Wipes HDD or tape (often ruins the HDD) | Does NOT work on SSD |
| Crypto-shredding | Destroy the encryption key so data is unreadable | Delete the cloud KMS key | The cloud disposal answer |
| Incinerate / pulverise | Burn to ash / crush to powder | Jala dena / peeskar choora | Physical destruction = highest assurance |
| Tokenisation | Replace data with a random token; the real value stays in a vault | Card number → token | No mathematical link to the original |
| Masking | Hide part of the data on screen | XXXX-XXXX-1234 | Display protection |
| Pseudonymisation | Replace identifiers but can re-identify with a separate key | Patient ID instead of name | Still personal data under GDPR |
| Anonymisation | Irreversibly remove identity | Aggregated statistics | Can never be linked back |
| Homomorphic encryption | Compute on data while it stays encrypted | Cloud analytics on encrypted records | Protects data in use |
| DLP | Stops sensitive data leaving | Block emailing card numbers outside | Data exfiltration |
| CASB | Control point between users and cloud apps | Find shadow IT, enforce policies | Cloud app visibility |
| IRM / DRM | Protection that travels with the file | A report that cannot be printed or forwarded | Control after distribution |
| Label vs marking | Label = machine-readable tag · Marking = human-readable stamp | Metadata tag vs “CONFIDENTIAL” header | — |